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Brief on Appeal 

Sir: 

In response to the Office action of September 9, 2004, and in connection with the 
Notice of Appeal filed on November 1 1 , 2004, the Assignee (IBM) respectfully 
submits the following Brief on Appeal. 



Real Party in Interest 

The real party in interest in the present appeal is International Business Machines 
Corporation (IBM), the assignee, as evidenced by the assignment set forth at reel 
011952, frame 0737. 

Related Appeals and Interferences 

None. 



Status of Claims 

Original claims 1-15 stand finally rejected by the examiner. Claims 1-15 are the 
claims on appeal. 
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Status of Amendments 

No amendments were filed subsequent to final rejection. 
Summary of Claimed Subject Matter 

The claimed subject matter relates generally to information handling, and more 
particularly to methods and systems to improve handling of personally identifiable 
information. In light of laws and public concern regarding privacy, there is a need for 
systems and methods to improve the handling of personally identifiable information. 

Independent Claim 1 involves identifying the parties involved in a process of 
handling personally identifiable information; identifying the data involved in the 
process; classifying the data; expressing each relationship between each pair of the 
parties in terms of a privacy agreement; and representing the parties, data, and 
privacy agreements graphically in one or more privacy agreement relationship 
diagrams. 

For example, as described in the specification (Page 23, Lines 5-16, or Paragraph 
0087 of the published version) and as shown in FIG. 7, the parties are identified (e.g. 
the book of the month club subscriber 721; the Subscription Department 722, 
Shipping Department 723, Billing Department 724, and Marketing Department 725 
of Borderless Books, an online bookstore). The data is identified and classified (e.g. 
subscription data 711 are personally identifiable information (Pll); purchasing 
patterns (not shown) are Pll). The privacy contracts or privacy agreements 710, 702, 
703, 704, 705, 706, 707, and 708 are built between each pair of parties for each 
different purpose. These elements are then represented graphically in one or more 



Page 2 



Brief on Appeal in Application No. 09/884,296 

privacy agreement relationship diagrams such as FIG. 7. 

For example, a privacy agreement between the Book of the Month Club Subscriber 
and the Borderless Books Subscription Department may look like the table in the 
specification at Pages 21-23, or Paragraph 0086 of the published version. 

Independent Claim 6 involves a system capable of executing the method described 
above. "The production of privacy agreement relationship diagrams ... may involve 
a consultant's computer interacting with a client organization's computer via a 
network, for example." Specification Page 23, or Paragraph 0087 of the published 
version. The "methods described are conveniently implemented in a general- 
purpose computer selectively activated or reconfigured by software...." Specification 
Page 24, Lines 10-25, or Paragraph 0090 of the published version. See also FIG. 
1. 

Independent Claim 1 1 involves a set of instructions on a computer-usable medium, 
or resident in a computer system, for executing the method described above. A 
possible implementation "is an application, namely a set of instructions (program 
code) in a code module which may, for example, be resident in the random access 
memory of a computer. Until required by the computer, the set of instructions may 
be stored in another computer memory, for example, in a hard disk drive, ... or 
downloaded via the Internet or other computer network." Specification Page 24, 
Lines 10-25, or Paragraph 0090 of the published version. 

Grounds of Rejection to be Reviewed on Appeal: 

The assignee respectfully asserts that: 
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1. It was erroneous to reject Claims 1-5, under 35 U.S.C. 101, as being directed to 
nonstatutory subject matter. A prima facie case of nonstatutory subject matter has 

not been established. 

2. It was erroneous to reject Claims 1-15, under 35 U.S.C. 103, over King, 
European Patent Application EP1,081,916A2, in view of Kroenke, Database 
Processing: Fundamentals, Design & Implementation, Chapter 3, and further in view 
of Spies, US Patent 5,689,565. A prima facie case of obviousness has not been 
established. 

Argument 

1. Argument regarding Claims 1-5, 35 U.S.C. 101 and statutory subject matter. 

The proper standard for patentable subject matter is found in State Street Bank & 
Trust Co. v. Signature Financial Group Inc., 149 F. 3d 1368, 1373, 47 USPQ2d 
1596, 1601-02 (Fed. Cir. 1998), cert, denied, 525 U.S. 1093 (1999), and quoted in 
MPEP 2106 II. A .: "The claimed invention as a whole must accomplish a practical 
application. That is, it must produce a 'useful, concrete and tangible result.'" 
[Emphasis added.] 

MPEP 2106 II. A . also states: "Office personnel have the burden to establish a 
prima facie case that the claimed invention as a whole is directed to solely an 
abstract idea or to manipulation of abstract ideas or does not produce a useful 
result." [Emphasis added.] 

It is clear that a useful, concrete and tangible result is produced by rejected Claims 
1-5, when these claims are read in light of the specification (e.g. pages 10-24, and 
FIG. 7). Claim 2 provides an example that can be briefly stated here: "mapping a 
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business process to the privacy rules that should govern the behavior of each pair 
of parties." See also the description at Page 23, or Paragraph 0088 of the published 
version of the specification: "Using this Privacy Agreement Framework, any business 
process can be mapped to the privacy rules that should govern the behavior of each 
pair of parties. The value to organizations is a clear pictorial representation, such as 
FIG. 7, of privacy-implicated relationships in the terms that organizations understand 
best - their own business entities and processes." In the present patent application, 
the Office cannot show that the claimed invention as a whole is directed to solely an 
abstract idea or to manipulation of abstract ideas or does not produce a useful result. 
Thus the Office has not satisfied its burden to establish a prima facie case of 
nonstatutory subject matter. 

The Office is not free to demand that method claims contain certain physical 
limitations, naming some "technological apparatus." (See Office action of September 
9, 2004, Page 3: "... the recited steps ... do not apply, involve, use, or advance the 
technological arts since all of the recited steps can be performed without the use of 
any technological apparatus No authority is cited for this.) On the contrary, 
MPEP 2106 II. A. contains examples of "claimed inventions that have a practical 
application because they produce useful, concrete, and tangible result." One of 
these examples is a case where claims (with method steps which did not name any 
apparatus) were drawn to a long-distance telephone billing process, and were held 
to be directed to patentable subject matter, because "the claimed process applies 
the Boolean principle to produce a useful, concrete, tangible result This is the 
case of AT&T Corp. v. Excel Communications, Inc., 172 F.3d 1352, 1358, 50 
USPQ2d 1447, 1452 (Fed. Cir. 1999). MPEP cites /ITS 7" again at MPEP 2106 IV B 
2 (b) ii): "Computer-Related Processes Limited to a Practical Application in the 
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Technological Arts ... A claim is limited to a practical application when the method, 
as claimed, produces a concrete, tangible and useful result; i.e., the method recites 
a step or act of producing something that is concrete, tangible and useful. See 
AT&T...." 

The Office action at Page 3 appears to assert that method claims need to contain 
certain physical limitations, that name some "technological apparatus." This is not 
supported by the MPEP, and is contrary to the above-mentioned court decision of 
AT&T. Consider claim 1 (the method steps do not name any apparatus) in AT&T, 
172 F.3d at 1354: "A method for use in a telecommunications system in which 
interexchange calls initiated by each subscriber are automatically routed over the 
facilities of a particular one of a plurality of interexchange carriers associated with 
that subscriber, said method comprising the steps of: 

generating a message record for an interexchange call between an originating 
subscriber and a terminating subscriber, and 

including, in said message record, a primary interexchange carrier (PIC) indicator 
having a value which is a function of whether or not the interexchange carrier 
associated with said terminating subscriber is a predetermined one of said 
interexchange carriers." 

The trial court held all of the method claims at issue invalid for failure to qualify as 
statutory subject matter. However, the Court of Appeals reversed the trial court, 
writing: "Excel also contends that because the process claims at issue lack physical 
limitations set forth in the patent, the claims are not patentable subject matter. This 
argument reflects a misunderstanding of our case law. ...had the [trial] court applied 
the proper analysis to the stated claims, the court would have concluded that all the 
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claims asserted fall comfortably within the broad scope of patentable subject matter 
under§ 101." AT&T, 172 F.3d at 1361. As in the AT& T case, rejected claims 1-5 in 
the present case fall comfortably within the broad scope of patentable subject 
matter. 

The Office action of September 9, 2004, on Page 3, states a test, without citing any 
authority: "For a process claim to pass muster, the recited process must somehow 
apply, involve, use, or advance the technological arts." The Assignee does not 
concede that this extra test is proper, considering the above-mentioned authorities. 
Even if this were a proper test, the present patent application passes that test. It is 
clear that technological arts are involved in rejected Claims 1-5, when these claims 
are read in light of the specification. "The production of privacy agreement 
relationship diagrams ... may involve a consultant's computer interacting with a client 
organization's computer via a network, for example." Specification Page 23, or 
Paragraph 0087 of the published version. See also Pages 10-24, or Paragraphs 
0035-0090 of the published version, and FIGS. 3-7. Thus the Office has not satisfied 
its burden to establish a prima facie case of nonstatutory subject matter. 

2. Argument regarding Claims 1-15, 35 U.S.C. 103 and lack of a prima facie 
case of obviousness: 

A. Limitations in the Rejected Claims Which Are Not Described in the 
References Relied On: 

As stated in MPEP 2143 and 2143.03, a requirement for establishing a prima facie 
case of obviousness is that the reference or references must teach or suggest all the 
claim limitations. In re Royka, 490 F.2d 981, 180 USPQ 580 (CCPA 1974). 
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The following language from rejected Claims 1 , 6, and 1 1 provides an example of 
limitations in the rejected claims which are not described in the references relied on: 

...expressing each relationship between each pair of said parties in terms of 

a privacy agreement; ... 

wherein: 

said privacy agreement uses a limited number of privacy-related actions 

concerning said personally identifiable information; 

said privacy agreement expresses rules regarding said privacy- related 

actions, for each of said parties; and 

said privacy agreement is specific to a single purpose. 

See also the description and example of a privacy agreement at Pages 20-23, or 
Paragraphs 0081-0086 of the published version of the specification. 

Nothing like this is found in the references the Office action relies on. Neither 
Kroenke nor Spies contain the phrase "privacy agreement." Privacy is not a topic 
treated in the Kroenke chapter that the Office action relies on. That chapter 
describes developing a data model using the entity-relationship model. Concerning 
"privacy-related actions," a phrase from rejected Claims 1, 6, and 11, the Office 
action cites Kroenke's Figure 3-15, which is merely a list of entities in a sailboat 
charter business. 

King happens to use the term "privacy agreement" in a narrow sense to mean 
something automatically "established between ... a client device and a content 
server," for reporting the location of a cell phone or other wireless device. King, 
page 2, lines 50-53; page 4, lines 36-43. King's example "privacy agreement" 
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concerns location and a location-based service (sending a tow truck to the location 
of a wireless client device). King, page 8, and page 2, lines 39-41. King mainly 
concerns reporting the location of a cell phone or other wireless device, a focus that 
is seen in each of King's drawings, Figures 1-10, or their written descriptions (e.g. 
absolute location object (ALO) in King's Figures 6 and 1 0, or handset location object 
(HLO) in King's Figures 8 and 9A). 

King's "privacy agreement" clearly does not have the same meaning, and does not 
have the breadth of utility shown for a privacy agreement in the subject patent 
application (e.g. specification Pages 20-24, or Paragraphs 0081-0089 of the 
published version, including an example privacy agreement between a person and 
a bookstore's subscription department). 

The following language from rejected Claims 1 , 6, and 1 1 provides another example 
of limitations in the rejected claims which are not described in the references relied 
on: "representing said parties, said data, and said privacy agreements graphically 
in one or more privacy agreement relationship diagrams Concerning this claim 
language, the Office action cites Kroenke's Figures 3-3 to 3-11, which are entity- 
relationship diagrams. Figure 3-3 illustrates a one-to-one relationship between an 
employee and an automobile, for example. A concern for privacy is not suggested 
in these. 

B. Why the References, Taken as a Whole, Do Not Suggest the Claimed 
Subject Matter: 

The cited references do not suggest a solution involving above-quoted subject 
matter of rejected Claims 1 , 6, and 1 1 (privacy agreements for example). On the 
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contrary, King and Kroenke teach away from the claimed subject matter. 

Teaching away is the antithesis of suggesting the claimed subject matter. In re Fine, 
837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988). King teaches away, by using the 
phrase "privacy agreement" in a narrow sense to mean something automatically 
established between "a wireless client cfew'ce and a server device" for reporting the 
location of a cell phone or other wireless device. King, page 4, lines 36-43 [emphasis 
added]. Thus King teaches away from: "expressing each relationship between each 
pair of said parties in terms of a privacy agreement," where parties may be "natural 
persons, departments, computer systems, or organizations," for example (language 
from Claim 1 and Paragraph 0085 in the subject patent application). 

King mainly concerns reporting the location of a cell phone or other wireless device, 
so King teaches away from utilizing a privacy agreement for other purposes, such 
as a privacy agreement between a subscriber and a bookstore's subscription 
department (example in Paragraph 0086 of the published version in the subject 
patent application). In an online bookstore, for example, a list of books purchased, 
together with the information on which subscriber purchased them, would be 
Personally Identifiable Information involved in a privacy agreement (see description 
of FIG. 5, Paragraph 0039, of the published version in the subject patent 
application). Other examples involving business, government and medicine are seen 
in the description of privacy-related actions, utilized by privacy agreements 
(description of FIG. 6, in Paragraphs 0064-0080 of the published version in the 
subject patent application). King leads away from such broadly useful subject matter, 
due to King's focus on the location of a wireless device. 
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Kroenke teaches away from any solution involving privacy-related actions. The 
Kroenke chapter that the Office action relies on concentrates on things, not actions. 
Kroenke deals with entity relationship models. "With this model, entities - which are 
identifiable things of importance to the users - are defined." Kroenke, page 67. 
Kroenke teaches us "to determine potential entities. Entities are usually represented 
by nouns (places, persons, concepts, events, equipment, and so on ) in documents 
or interviews." Kroenke, page 61. "Look for nouns that seem important to the 
design." Kroenke, page 65. Kroenke's focus is on nouns, not verbs (i.e. things, not 
actions). 

C. Why Features Disclosed in One Reference May Not Properly Be Combined 
with Features Disclosed in Another Reference: 

As stated in MPEP 2143 and 2143.01 , a requirement for establishing a prima facie 
case of obviousness is that there must be some suggestion or motivation to combine 
reference teachings. In re Rouffet, 149 F.3d 1 350, 1 357, 47 USPQ2d 1453, 1457-58 
(Fed. Cir. 1998). As quoted in MPEP 2143.01 : "The mere fact that references can 
be combined or modified does not render the resultant combination obvious unless 
the prior art also suggests the desirability of the combination." In re Fritch, 972 F.2d 
1260, 23 USPQ 2d 1780, 1783-84 (Fed. Cir. 1992). 

A suggestion or motivation to combine reference teachings is absent in this case. 
Neither King nor Spies suggest the desirability of any particular kind of diagram or 
data model described by Kroenke. Kroenke does not suggest the desirability of 
King's location information for a cell phone. Kroenke does not suggest the 
desirability of Spies's approach to cryptography. Thus it was improper to combine 
these references as a basis for rejection of claims in the present case. 
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D. Nonanalogous Art Cannot Be Used to Establish Obviousness 

As stated in In re Oetiker, 977 F.2d 1443, 1446, 24 USPQ2d 1443, 1445 (Fed. Cir. 
1992), and quoted in MPEP 2141.01(a) : "In order to rely on a reference as a basis 
for rejection of an applicant's invention, the reference must either be in the field of 
applicant's endeavor or, if not, then be reasonably pertinent to the particular problem 
with which the inventor was concerned." 

In the present case, the field of applicants' endeavor or the particular problem with 
which the inventors were concerned, are apparent in some excerpts from the subject 
patent application: "In light of laws and public concern regarding privacy, there is a 
need for systems and methods to improve the handling of personally identifiable 
information." Specification Page 2. "[AJctions taken at block 205 are checking for 
compliance [with law or contract], and identifying ways to improve the information- 
handling process. The result is feedback to the information-handling process, at 
block 201 ." FIG. 2 and specification Page 9. "The production of privacy agreement 
relationship diagrams ... may involve a consultant's computer interacting with a client 
organization's computer via a network, for example." Specification Page 23, or 
Paragraph 0087. A diagram such as FIG. 7 facilitates "identifying opportunities to 
reduce privacy-related risks involved in business processes." Specification Page 24, 
or Paragraph 0089. 

However, the cited references are not in the same field, and are not reasonably 
pertinent to the same problem. On the contrary, Kroenke's field is the fundamentals, 
design and implementation of databases, with no special concern for privacy. King 
is mainly concerned about location information for a cell phone or other wireless 
device. The Spies reference is in the field of cryptography: "keeping messages 
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secure from eavesdroppers." Thus it was improper to rely on these references as a 
basis for rejection of claims in the present case. 

3. Separate argument regarding Claim 2, 35 U.S.C. 103 and lack of a prima 
facie case of obviousness: 

The following language from rejected Claim 2 provides another example of a 
limitation not taught or suggested in the references relied on: "mapping a business 
process to the privacy rules that should govern the behavior of each pair of parties." 
To read this language from rejected Claim 2 in light of the specification, see the 
example of a privacy agreement at Pages 21 -23, or Paragraph 0086 of the published 
version of the specification (especially sections marked "Rules for Party A in current 
context" and "Rules for Party B in current context"). See also the description of a 
privacy agreement at Page 20, or Paragraph 0083 of the published version of the 
specification: "The rules applied to these actions are derived from the organization's 
overall privacy policy." See also the description at Page 23, or Paragraph 0088 of 
the published version of the specification: "Using this Privacy Agreement 
Framework, any business process can be mapped to the privacy rules that should 
govern the behavior of each pair of parties. The value to organizations is a clear 
pictorial representation, such as FIG. 7, of privacy-implicated relationships in the 
terms that organizations understand best - their own business entities and 
processes." 

The cited references (Kroenke and King) do not teach or suggest a solution involving 
above-quoted subject matter of rejected Claim 2. Concerning Claim 2, the Office 
action cites Kroenke's page 67, merely containing a general discussion of choosing 
among different ways of modeling a business situation. Concerning Claim 2, the 
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Office action cites Kroenke's Figure 3-3, which is an entity-relationship diagram. 
Figure 3-3 illustrates a one-to-one relationship between an employee and an 
automobile, for example. A concern for privacy is not suggested in Kroenke's Figure 
3-3. King teaches away from the claimed subject matter. King uses the phrase 
"privacy agreement" in a narrow sense to mean something automatically established 
between "a wireless client device and a server device," for reporting the location of 
a wireless device. King, page 4, lines 36-43 [emphasis added]. Thus King teaches 
away from "mapping a business process to the privacy rules that should govern the 
behavior of each pair of parties," where parties may be "natural persons, 
departments, computer systems, or organizations," for example (language from 
Claim 2 and Page 20 or Paragraph 0085 in the subject patent application). A prima 
facie case of obviousness has not been established. 

Conclusion 

For the reasons advanced above, Assignee respectfully contends that each claim 
is patentable, and requests the reversal of all rejections. 

Respectfully submitted, 



Paul D. Heydon ^ 
Attorney for Assignee 
Reg. No. 46,769 
3004 Nacogdoches Road 
San Antonio, TX 78217 
(210) 930-4300 

Attachment: Claims Appendix 
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CLAIMS APPENDIX 

1. A method for improving the handling of personally identifiable information, said 
method comprising: 

identifying the parties involved in a process of handling personally identifiable 
information; 

identifying the data involved in said process; 
classifying the data; 

expressing each relationship between each pair of said parties in terms of a privacy 
agreement; and 

representing said parties, said data, and said privacy agreements graphically in one 

or more privacy agreement relationship diagrams, 

wherein: 

said privacy agreement uses a limited number of privacy-related actions concerning 
said personally identifiable information; 

said privacy agreement expresses rules regarding said privacy- related actions, for 
each of said parties; and 

said privacy agreement is specific to a single purpose. 

2. The method of Claim 1 , further comprising mapping a business process to the 
privacy rules that should govern the behavior of each pair of parties. 

3. The method of Claim 1 , further comprising identifying opportunities to reduce 
privacy-related risks involved in said process. 

4. The method of Claim 3, further comprising identifying unnecessary exchanges of 
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data, for possible elimination. 

5. The method of Claim 3, further comprising identifying opportunities to transform 
data into a less sensitive form. 

6. A system for improving the handling of personally identifiable information, said 
system comprising: 

means for identifying the parties involved in a process of handling personally 
identifiable information; 

means for identifying the data involved in said process; 
means for classifying the data; 

means for expressing each relationship between each pair of said parties in terms 
of a privacy agreement; and 

means for representing said parties, said data, and said privacy agreements 

graphically in one or more privacy agreement relationship diagrams, 

wherein; 

said privacy agreement uses a limited number of privacy-related actions concerning 
said personally identifiable information; 

said privacy agreement expresses rules regarding said privacy- related actions, for 
each of said parties; and 

said privacy agreement is specific to a single purpose. 

7. The system of Claim 6, further comprising means for mapping a business process 
to the privacy rules that should govern the behavior of each pair of parties. 

8. The system of Claim 6, further comprising means for identifying opportunities to 
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reduce privacy-related risks involved in said process. 

9. The system of Claim 8, further comprising means for identifying unnecessary 
exchanges of data, for possible elimination. 

10. The system of Claim 8, further comprising means for identifying opportunities to 
transform data into a less sensitive form. 

11. A computer-usable medium having computer-executable instructions for 
improving the handling of personally identifiable information, said computer- 
executable instructions comprising: 

means for identifying the parties involved in a process of handling personally 
identifiable information; 

means for identifying the data involved in said process; 
means for classifying the data; 

means for expressing each relationship between each pair of said parties in terms 
of a privacy agreement; and 

means for representing said parties, said data, and said privacy agreements 

graphically in one or more privacy agreement relationship diagrams, 

wherein; 

said privacy agreement uses a limited number of privacy-related actions concerning 
said personally identifiable information; 

said privacy agreement expresses rules regarding said privacy- related actions, for 
each of said parties; and 

said privacy agreement is specific to a single purpose. 



Page 17 



Brief on Appeal in Application No. 09/884,296 

12. The computer-usable medium of Claim 11, further comprising means for 
mapping a business process to the privacy rules that should govern the behavior of 
each pair of parties. 

13. The computer-usable medium of Claim 11, further comprising means for 
identifying opportunities to reduce privacy-related risks involved in said process. 

14. The computer-usable medium of Claim 13, further comprising means for 
identifying unnecessary exchanges of data, for possible elimination. 

15. The computer-usable medium of Claim 13, further comprising means for 
identifying opportunities to transform data into a less sensitive form. 
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